rpms/criu
7
0
Fork 0
Code Issues Pull Requests Releases Activity

criu: Re-enable binary hardening flags for main binary

Browse Source
This commit is contained in:
Christopher Lusk 2026-03-02 09:23:25 -05:00
parent 3bcc22dfb6
commit 4c6f4911a0
1 changed files with 34 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
criu.spec
View File

@ -1,18 +1,19 @@
%global py_prefix python3
%global py_binary %{py_prefix}
# With annobin enabled, CRIU does not work anymore. It seems CRIU's
# parasite code breaks if annobin is enabled.
# CRIU's parasite/restorer code (criu/pie/) is compiled with its own CFLAGS
# that already disable hardening (-fno-stack-protector, -U_FORTIFY_SOURCE,
# -D_FORTIFY_SOURCE=0, -nostdlib). Standard RHEL hardening flags (PIE, RELRO,
# FORTIFY_SOURCE, stack protector) only affect the main criu binary and libs.
#
# Annobin remains disabled because its instrumentation gets injected into
# every compilation unit including parasite code, and there is no per-target
# way to exclude it through the Makefile.
%undefine _annotated_build
# Disable automatic call to the set_build_flags macro
# at the beginning of the build, check, and install.
# This change was introduced in Fedora 36.
%undefine _auto_set_build_flags
Name: criu
Version: 4.2
Release: 1%{?dist}
Release: 2%{?dist}
Summary: Tool for Checkpoint/Restore in User-space
License: GPL-2.0-only AND LGPL-2.1-only AND MIT
URL: http://criu.org/
@ -110,18 +111,34 @@ This script can help to workaround the so called "PID mismatch" problem.
# that is fixed, disable LTO.
%define _lto_cflags %{nil}
# CRIU's nmk build system calls ld directly for intermediate partial linking
# (ld -r). RHEL LDFLAGS contain -specs= options that only gcc understands;
# raw ld rejects them. Create a wrapper that strips -specs= for direct ld
# calls. The final criu binary link uses gcc (CC), not ld, so it still gets
# full hardening (-pie, -z relro, -z now) from the spec files.
mkdir -p %{_builddir}/bin
cat > %{_builddir}/bin/ld << 'LDWRAPPER'
#!/bin/sh
for arg do
shift
case "$arg" in -specs=*) continue ;; esac
set -- "$@" "$arg"
done
exec /usr/bin/ld "$@"
LDWRAPPER
chmod +x %{_builddir}/bin/ld
# %{?_smp_mflags} does not work
# -fstack-protector breaks build
CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES
CFLAGS+="%{optflags}" make V=1 WERROR=0 LD=%{_builddir}/bin/ld PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_binary} PLUGINDIR=%{_libdir}/criu NETWORK_LOCK_DEFAULT=NETWORK_LOCK_NFTABLES
make docs V=1
%install
sed -e "s,--upgrade --ignore-installed,--no-index --no-deps -v --no-build-isolation,g" -i lib/Makefile -i crit/Makefile
make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
make install-crit DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
make install-criu LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
make install-lib LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
make install-crit LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} BINDIR=%{_bindir} SBINDIR=%{_sbindir} PYTHON=%{py_binary} PIPFLAGS="--no-build-isolation --no-index --no-deps --progress-bar off --upgrade --ignore-installed"
make install-man LD=%{_builddir}/bin/ld DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
rm -f $RPM_BUILD_ROOT%{_mandir}/man1/compel.1
rm -f $RPM_BUILD_ROOT%{_mandir}/man1/criu-amdgpu-plugin.1
@ -162,6 +179,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libcriu.a
%doc %{_mandir}/man1/criu-ns.1*
%changelog
* Mon Mar 02 2026 Christopher Lusk <clusk@redhat.com> - 4.2-2
- Re-enable binary hardening flags for main binary
* Tue Nov 18 2025 Adrian Reber <areber@redhat.com> - 4.2-1
- Update to 4.2